Welcome to Splunk Answers, a Q&A forum for users to find answers to questions about deploying, managing, and using Splunk products. Contributors of all backgrounds and levels of expertise come here to find solutions to their issues, and to help other users in the Splunk community with their own questions.

This quick tutorial will help you get started with key features to help you find the answers you need. You will receive 10 karma points upon successful completion!

Refine your search:

ANNOUNCEMENT: Answers is being migrated to a brand new platform! answers.splunk.com will be read-only from 5:00pm PDT June 4th - 9:00am PDT June 9th. Please read this Answers thread for all details about the migration.

Welcome to Splunk Answers! Not what you were looking for? Refine your search.

Splunk Add-on for Infoblox: Why are sourcetype transformations not working after upgrade to a distributed environment?

1

We recently moved from a single indexer/search head to a distributed environment. I have a couple of apps/TA's that have sourcetype transforms, one being Splunk Add-on for Infoblox. This TA stopped working after our upgrade. I verified that the props and transforms configs are on the Cluster Master and have been pushed to our two indexers. They are also on the search head. The documentation indicates that the TA supports a distributed environment.

Does anyone have any suggestions on how to troubleshoot this issue? I know the config is good since it was working before. The logs are being ingested from a server with a Universal Forwarder on it, which sets the sourcetype to infoblox:file.

Thanks for the advice, I wasn't familiar with btool, it's exactly what I needed. I found that the props and transforms for the app weren't being used, which led me to read up on how apps should be deployed in a distributed environment. Our admin placed the apps under the wrong directory on the Master Cluster server. Once I moved them to the correct location, and re-deployed them my sourcetypes began working!

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here. Closing this box indicates that you accept our Cookie Policy.